Fix out-of-bounds exception in SetComposingRegion().

BUG=401536

Review URL: https://codereview.chromium.org/445363009

Cr-Commit-Position: refs/heads/master@{#288198}
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@288198 0039d316-1c4b-4281-b951-d872f2087c98

content/public/android/java/src/org/chromium/content/browser/input/AdapterInputConnection.java

@@ -463,7 +463,7 @@ public class AdapterInputConnection extends BaseInputConnection {
 
         CharSequence regionText = null;
         if (b > a) {
-            regionText = mEditable.subSequence(start, end);
+            regionText = mEditable.subSequence(a, b);
         }
         return mImeAdapter.setComposingRegion(regionText, a, b);
     }

content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java

@@ -461,6 +461,21 @@ public class ImeTest extends ContentShellTestBase {
         assertEquals("", mConnection.getTextBeforeCursor(9, 0));
     }
 
+    @SmallTest
+    @Feature({"TextInput", "Main"})
+    public void testSetComposingRegionOutOfBounds() throws Throwable {
+        DOMUtils.focusNode(mContentViewCore, "textarea");
+        assertWaitForKeyboardStatus(true);
+
+        mConnection = (TestAdapterInputConnection) getAdapterInputConnection();
+        waitAndVerifyEditableCallback(mConnection.mImeUpdateQueue, 0, "", 0, 0, -1, -1);
+        setComposingText(mConnection, "hello", 1);
+
+        setComposingRegion(mConnection, 0, 0);
+        setComposingRegion(mConnection, 0, 9);
+        setComposingRegion(mConnection, 9, 0);
+    }
+
     @SmallTest
     @Feature({"TextInput", "Main"})
     public void testEnterKeyEventWhileComposingText() throws Throwable {